@onesub/server 0.13.1 → 0.14.0

package/dist/index.js

@@ -248,10 +248,12 @@ function mockValidateAppleProduct(receipt, expectedProductId) {
   const outcome = classifyMockReceipt(receipt);
   if (!outcomePasses(outcome, "apple")) return null;
   const productId = expectedProductId ?? "mock_product";
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     transactionId: deterministicTransactionId(`mock_apple_${productId}`, receipt),
     productId,
-    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...tokenMatch ? { appAccountToken: tokenMatch[1] } : {}
   };
 }
 function mockValidateGoogleSubscription(receipt, productId) {
@@ -273,9 +275,11 @@ function mockValidateGoogleSubscription(receipt, productId) {
 function mockValidateGoogleProduct(receipt, productId) {
   const outcome = classifyMockReceipt(receipt);
   if (!outcomePasses(outcome, "google")) return null;
+  const tokenMatch = receipt.match(/#token=([^#]+)/);
   return {
     transactionId: deterministicTransactionId(`mock_google_${productId}`, receipt),
-    purchasedAt: (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...tokenMatch ? { obfuscatedExternalAccountId: tokenMatch[1] } : {}
   };
 }
 
@@ -439,7 +443,8 @@ async function validateAppleConsumableReceipt(signedTransaction, config, expecte
   return {
     transactionId,
     productId: tx.productId,
-    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: tx.purchaseDate ? new Date(tx.purchaseDate).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    appAccountToken: tx.appAccountToken ?? void 0
   };
 }
 async function decodeAppleNotification(payload, skipJwsVerification = false) {
@@ -998,7 +1003,8 @@ async function validateGoogleProductReceipt(purchaseToken, productId, config, ty
   }
   return {
     transactionId: purchase.orderId,
-    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+    purchasedAt: purchase.purchaseTimeMillis ? new Date(parseInt(purchase.purchaseTimeMillis, 10)).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
+    obfuscatedExternalAccountId: purchase.obfuscatedExternalAccountId
   };
 }
 function decodeGoogleNotification(payload) {
@@ -1544,6 +1550,7 @@ function createPurchaseRouter(config, purchaseStore) {
       }
       let transactionId = null;
       let purchasedAt = (/* @__PURE__ */ new Date()).toISOString();
+      let boundAccountId = null;
       if (platform === "apple") {
         if (!config.apple) {
           sendError(res, 500, ONESUB_ERROR_CODE.APPLE_CONFIG_MISSING, "Apple configuration not provided", NO_PURCHASE);
@@ -1553,6 +1560,7 @@ function createPurchaseRouter(config, purchaseStore) {
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
+          boundAccountId = result.appAccountToken ?? null;
         }
       } else {
         if (!config.google) {
@@ -1568,12 +1576,26 @@ function createPurchaseRouter(config, purchaseStore) {
         if (result) {
           transactionId = result.transactionId;
           purchasedAt = result.purchasedAt;
+          boundAccountId = result.obfuscatedExternalAccountId ?? null;
         }
       }
       if (!transactionId) {
         sendError(res, 422, ONESUB_ERROR_CODE.RECEIPT_VALIDATION_FAILED, "Receipt validation failed", NO_PURCHASE);
         return;
       }
+      if (boundAccountId && boundAccountId.toLowerCase() !== userId.toLowerCase()) {
+        log.warn(
+          `[onesub/purchase] account binding mismatch for transaction ${transactionId}: token does not match userId ${userId}`
+        );
+        sendError(
+          res,
+          409,
+          ONESUB_ERROR_CODE.TRANSACTION_BELONGS_TO_OTHER_USER,
+          "TRANSACTION_BELONGS_TO_OTHER_USER",
+          NO_PURCHASE
+        );
+        return;
+      }
       const existing = await purchaseStore.getPurchaseByTransactionId(transactionId);
       let action = "new";
       if (existing) {